FEATURE: add an env-sharing script #29
Conversation
ctmbl
added
enhancement
There was a problem hiding this comment.
I personally have nothing to say about the code in itself but after trying it I have 4 points:
- as @atxr said it please provide a dependency check for
gpgand the archive software - the script currently doesn't work well for user in two word, I tried with mine "Clement Mabileau" --> it interprets it as two different users and then creates two encrypted file. But that's normal looking at the code and I don't think that's important once you know it, you just have to specify only
./gpg-share.sh file Mabileau! - currently the script isn't really clean because it leaves the user with multiple encrypted files at root without removing them after the archive is created (or
7zzdoes it? I could find out because I don't have this one 😕), consider either cleaning them or put them in/tmpI think! - you should add the
scriptfolder to the README repository structure I think!
For instance, as `npm` is not installed on my machine but required to get the version of the project, i have ```bash > ./scripts/gpg-share.sh .env.example "Alexandre Tullot" ./scripts/gpg-share.sh: warning: 'npm' is required ./scripts/gpg-share.sh: error: one or more dependencies are missing ```
This commit does 3 things: - move the user check after the creation of the `users` array, to avoid passing `users` to the function and breaking the array (bash...) - read `stdin` when `USER_FILE` is not defined and use `readarray` when it is set and the file exists - remove the extra newline from the user name with `echo -n "$_user"` (bash... it works in a shell but not in the script :shrugging:)
the dependencies might change, e.g.
yep, that's how arrays work in # users.txt
Alexandre Tullot
amtoineand USER_FILE=users.txt ./scripts/gpg-share .env.productionshould only try to use "
i moved the files to
added in 7c68495 😋 |
i've tried that in the previous comment and commits 😉 |
love these three tks! However the script still doesn't work as expected, but that seems normal as you couldn't test it 😕 So why does it says weird things about the the key not belonging to the named user? Or is it because of the weird Also when using the and Every of these bugs would have been found by you if you could run it on your computer 😕 , maybe you can create a VM or a container? or test it through ssh on the iscsc server? |
|
i can test the script by applying diff --git a/scripts/gpg-share.sh b/scripts/gpg-share.sh
index 3619dfd..300a4e4 100755
--- a/scripts/gpg-share.sh
+++ b/scripts/gpg-share.sh
@@ -26,7 +26,7 @@ log_info () {
DEPENDENCIES=(
- npm
+ # npm
gpg
7zz
)
@@ -52,7 +52,8 @@ check_dependencies () {
check_dependencies
# get the version
-VERSION=$(npm pkg get version | sed 's/"//g')
+# VERSION=$(npm pkg get version | sed 's/"//g')
+VERSION="0.1.0"
# build the archive name
ARCHIVE="keys-${VERSION}.7z"do not worry 😉
|
|
if forgot a fix regarding the fix should be complete in 30f860c |
|
so, for now, please test the script only from the root 😉 |
|
yep, this script assumes the keyring of the user is in good shape 🤔 the path
i've added a check in b069dd5 the USER_FILE variable
cool 💪
i've changed the way i store the files in the archive:grey_exclamation:
that way
i can think of that after the above changes are good to go 😉 |
|
mm, for the multi-word users.... what about not allowing them? EDITactually it's an issue with the way propositionthe following diff diff --git a/scripts/gpg-share.sh b/scripts/gpg-share.sh
index dbb4041..0482eed 100755
--- a/scripts/gpg-share.sh
+++ b/scripts/gpg-share.sh
@@ -137,7 +138,7 @@ encrypt () {
do
user=$(echo -n "$_user")
log_info "encrypting '$file' for '$user' inside '$DUMP_DIR'..."
- gpg --verbose --recipient "$user" --encrypt --armor --output "$DUMP_DIR/$file.$user.asc" "$file"
+ gpg --verbose --recipient "$user" --encrypt --armor --output $(echo "$DUMP_DIR/$file.$user.asc" | sed 's/\s\+/-/g') "$file"
done
log_success "all encrypted file have been saved inside '$DUMP_DIR'"
}
@@ -149,7 +150,7 @@ archive () {
# subshell here to avoid archiving the paths to the .asc files
(
cd "$DUMP_DIR"
- tar cvf "$ARCHIVE" $(find . -type f)
+ tar cvf "$ARCHIVE" $(find . -type f | sed 's/\s\+/-/g')
)
cp "$DUMP_DIR/$ARCHIVE" .
}works with amtoine
Alexandre tulloti simply replace the whitespaces in the filenames with "-" 😏 |
the path when running
Exactly what I thought about! Tks a lot! multiple works user ids/ whitespaces problem
I really love that! It's really prettier I think and also more reliable 😉
I was just going to ping you about that... However you don't need this - tar cvf "$ARCHIVE" $(find . -type f)
+ tar cvf "$ARCHIVE" $(find . -type f | sed 's/\s\+/-/g')because you already saved the encrypted files without whitspaces 😉, but it sure doesn't harm 👍 Overall I agree with your proposition flags
|
There was a problem hiding this comment.
You did an amazing work thank you for your contribution!
As @ctmbl said, it works fine for me with names of multiple words with this diff
- gpg --verbose --recipient "$user" --encrypt --armor --output "$DUMP_DIR/$file.$user.asc" "$file"
+ gpg --verbose --recipient "$user" --encrypt --armor --output $(echo "$DUMP_DIR/$file.$user.asc" | sed 's/\s\+/-/g') "$file"Regarding the user option with -u and -U it would be great but that's up to you. This script solves the initial issue, so I'll approve this merge! 🚀
|
glad it works 😌 i've added the fix in the latest a04938a 👍 flags -u and -U
if that's ok with you both, i'd like to close this PR, as @atxr said it solves the original issue, and think of improvements in an issue i can open right after the merge 😋 |
|
also, please solve the threads if they have been addressed 😉 |
Perfect 👌 flags -u and -U
Totally fine for me 😉 |
|
@ctmbl, there it is 👌 |
Related to #13.
This PR adds a script, in the
./scripts/directory, to easily share secret files to the members of theiscsc.frteam.the script itself
usage
./scripts/gpg-share.sh $file $[list of gpg users]source
legend
🔵 there is an info
🟢 there is a success message
🟠 there is a warning
🔴 there is an error and the script halts
in order
$fileand checks:gpg🔵$ARCHIVEwith7z🔵